Security design principles in GCP - Commands & Configuration

Introduction

Security design principles help protect your cloud resources from unauthorized access and damage. They guide how to build systems that keep data safe and services reliable.

When you want to control who can access your cloud storage buckets to keep data private.

When you need to limit what actions users or services can perform on your virtual machines.

When you want to protect your applications from attacks by isolating network traffic.

When you need to ensure that only encrypted data is stored and transmitted.

When you want to monitor and log access to your cloud resources for auditing.

Commands

This command gives Alice read-only access to the project, following the principle of least privilege by granting only necessary permissions.

Terminal

gcloud projects add-iam-policy-binding example-project --member=user:[e-mail] --role=roles/viewer

Expected Output

Updated IAM policy for project [example-project].

→

--member - Specifies the user or service account to grant permissions.

→

--role - Defines the level of access granted.

This command creates a firewall rule to allow internal traffic within the network, implementing network segmentation to reduce exposure.

Terminal

gcloud compute firewall-rules create allow-internal --direction=INGRESS --priority=1000 --network=default --action=ALLOW --rules=tcp,udp,icmp --source-ranges=10.128.0.0/9

Expected Output

Creating firewall rule [allow-internal]...done.

→

--direction - Specifies the direction of traffic the rule applies to.

→

--rules - Defines allowed protocols and ports.

This command creates a key for encrypting data, supporting the principle of data protection by encrypting sensitive information.

Terminal

gcloud kms keys create my-key --location=us-east1 --keyring=my-keyring --purpose=encryption

Expected Output

Created key [my-key].

→

--location - Specifies the region for the key.

→

--purpose - Defines the key's use, here for encryption.

This command sets up logging to capture and store logs from compute instances, enabling monitoring and auditing.

Terminal

gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter='resource.type=gce_instance' --project=example-project

Expected Output

Created sink [my-sink].

→

--log-filter - Filters logs to capture specific resource types.

Key Concept

If you remember nothing else from security design principles, remember: always grant the minimum access needed and protect data with encryption and monitoring.

Common Mistakes

Granting broad permissions like owner or editor to all users.

This exposes resources to accidental or malicious changes, increasing risk.

Assign specific roles with only the permissions users need, such as viewer or custom roles.

Not setting firewall rules to restrict network traffic.

This leaves resources open to attacks from any source.

Create firewall rules that allow only necessary traffic from trusted sources.

Storing sensitive data without encryption.

Data can be exposed if storage is compromised.

Use Cloud KMS to encrypt data at rest and in transit.

Summary

Use IAM roles to give users only the permissions they need.

Create firewall rules to control network access and isolate resources.

Encrypt sensitive data using Cloud KMS keys.

Set up logging to monitor access and changes for security auditing.

Practice

1. Which security design principle means giving users only the access they need and nothing more?

easy

A. Secure by default

B. Defense in depth

C. Continuous monitoring

D. Least privilege

Solution

1. Step 1: Understand the principle of least privilege

   Least privilege means users get only the minimum access needed to do their job.

2. Step 2: Compare with other principles

   Defense in depth means multiple layers of security, secure by default means safe settings initially, monitoring means watching for issues.

3. Final Answer:

   Least privilege -> Option D

4. Quick Check:

   Minimum access = Least privilege [OK]

Hint: Minimum access means least privilege [OK]

Common Mistakes:

• Confusing defense in depth with least privilege
• Thinking secure by default means limited access
• Mixing monitoring with access control

2. Which of the following is the correct way to assign a role to a user in GCP IAM using the gcloud CLI?

easy

A. gcloud iam roles assign [e-mail] roles/viewer

B. gcloud iam add-role [e-mail] viewer

C. gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer

D. gcloud iam set-role [e-mail] roles/viewer

Solution

1. Step 1: Recall correct gcloud command syntax for IAM role assignment

   The correct command uses 'projects add-iam-policy-binding' with --member and --role flags.

2. Step 2: Check each option

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer matches the correct syntax; others use invalid commands or flags.

3. Final Answer:

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer -> Option C

4. Quick Check:

   IAM role assignment uses add-iam-policy-binding [OK]

Hint: Use add-iam-policy-binding with --member and --role [OK]

Common Mistakes:

• Using incorrect gcloud commands like 'iam roles assign'
• Omitting --member or --role flags
• Confusing roles with users in command syntax

3. Consider this GCP IAM policy snippet:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:[e-mail]"]
    }
  ]
}

What access does Alice have on the storage bucket?

medium

A. Full control including deleting objects

B. Read-only access to objects

C. No access at all

D. Can create and delete buckets

Solution

1. Step 1: Identify Alice's assigned role

   Alice has the role 'roles/storage.objectViewer' which grants read-only access to objects.

2. Step 2: Understand role permissions

   ObjectViewer allows viewing objects but not modifying or deleting them.

3. Final Answer:

   Read-only access to objects -> Option B

4. Quick Check:

   ObjectViewer = read-only access [OK]

Hint: Viewer roles mean read-only access [OK]

Common Mistakes:

• Confusing objectAdmin with objectViewer
• Assuming viewer can delete objects
• Mixing bucket-level and object-level permissions

4. You wrote this IAM policy JSON but get an error when applying it:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["[e-mail]"]
    }
  ]
}

What is the error and how to fix it?

medium

A. Missing 'user:' prefix before bob's email in members; add 'user:'

B. Role 'roles/storage.objectAdmin' does not exist; use 'roles/storage.admin'

C. JSON syntax error; remove trailing commas

D. Members list must be empty for objectAdmin role

Solution

1. Step 1: Check members format in IAM policy

   Each member must have a prefix like 'user:', 'serviceAccount:', etc.

2. Step 2: Identify the missing prefix for [e-mail]

   Bob's member entry lacks 'user:' prefix, causing the error.

3. Final Answer:

   Missing 'user:' prefix before bob's email in members; add 'user:' -> Option A

4. Quick Check:

   Member identifiers need prefixes like 'user:' [OK]

Hint: Always prefix members with user: or serviceAccount: [OK]

Common Mistakes:

• Omitting user: prefix in members list
• Assuming roles names are incorrect without checking
• Misreading JSON syntax errors

5. You want to design a GCP project with strong security. Which combination of principles and practices best protects your resources?

hard

A. Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing

B. Use secure by default settings only, no need for monitoring or role restrictions

C. Grant all users owner role for flexibility, disable monitoring to reduce noise, and use default network settings

D. Assign broad roles to users, enable audit logging, and rely on firewall rules only

Solution

1. Step 1: Identify key security principles for GCP

   Least privilege limits access, defense in depth adds multiple security layers, and continuous auditing monitors activity.

2. Step 2: Evaluate options for best security practice

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing combines these principles correctly; others either grant excessive access or skip monitoring.

3. Final Answer:

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing -> Option A

4. Quick Check:

   Least privilege + defense in depth + monitoring = strong security [OK]

Hint: Combine least privilege, defense in depth, and monitoring [OK]

Common Mistakes:

• Granting overly broad roles
• Ignoring monitoring and auditing
• Relying only on default settings